- Freeradius-Users - lists.freeradius.org

[Exit code]User logging in out from login-time
by rod~ 28 Mar '10

28 Mar '10

Hi all, I'm new to freeradius and I've got this question: What is the exit code for a user trying to authenticate outside the Login-time defined parameters? I need to get this code and then trigger an error message... Any help? Thanks a lot in advance. [ ]'s Rod Elias

2 1

Bug fixes on v2.1.8
by Sergio 27 Mar '10

27 Mar '10

Hi people, and developers, i can see that you finally fixed a bug that i and others like me mentioned at this forum at least one year ago. I'm glad to see it :) To be precise, i'm talking about the fix that "sign client certificates with CA, rather than server certs". And here i was, talking alone one year ago on this thread: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls) In spite of that, i'd like to say that freeradius is a great job, congratulations to its developers. I think is the most configurable server. OCSP would be great!! bye and thanks :) -- Sergio

1 0

Freeradius doesn't accept CoA-ACK or CoA-NAK.
by Rabidinov M.A. 27 Mar '10

27 Mar '10

Hi, Freeradius-users. I have configured Freeradius 2.1.8 to check online users in blocked table. On accept accounting request, freeradius asks a mysql table "blocked" for a login. If TRUE, freeradius server send CoA packet to disconnect PPPoE session. Freeradius server sends CoA packet to NAS, PPPoE session is droped and NAS send CoA-ACK, that pppoe session was droped. But freeradius doesn't recognize CoA-ACK and try more send CoA packet to NAS. NAS replys CoA-NAK, but freeradius doesn't recognize it too, and make 3-4 attempts to send CoA packet to NAS. Configs: iptv:~ # grep -v '#' /etc/raddb/sites-enabled/default .... accounting { detail unix radutmp sql attr_filter.accounting_response if ("%{Acct-Status-Type}" != "Stop") { if ("%{sql: SELECT username from blocked where username = '%{User-Name}'}") { update coa { User-Name = "%{User-Name}" Cisco-Account-Info = "S%{Framed-IP-Address}" Cisco-AVPair = "subscriber:command=account-logoff" } } } } .... iptv:~ # grep -v '#' /etc/raddb/sites-enabled/cisco7206 home_server cisco7206 { type = coa ipaddr = xx.xx.64.94 port = 1700 secret = xxxx retry_count = 1 coa { irt = 1 mrt = 1 mrc = 10 mrd = 5 } } home_server_pool coa { type = fail-over home_server = cisco7206 } iptv:~ # grep -v '#' /etc/raddb/clients.conf client xx.xx.64.94 { secret = xxxxx nastype = cisco coa_server = cisco7206 } ***************************************** Debug: Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Finished request 8. Cleaning up request 8 ID 98 with timestamp +248 Going to the next request Waking up in 2.1 seconds. rad_recv: CoA-ACK packet from host xx.xx.64.94 port 1700, id=10, length=82 Ignoring proxy reply that arrived after we sent a reply to the NAS Waking up in 2.1 seconds. rad_recv: Accounting-Request packet from host xx.xx.64.94 port 1646, id=102, length=467 Acct-Session-Id = "000001A2" Framed-Protocol = PPP Framed-Route = "yy.yy.26.196 255.255.255.252 0.0.0.0 12" Framed-Route = "yy.yy.30.100 255.255.255.252 0.0.0.0 12" Framed-IP-Address = yy.yy.30.2 Cisco-AVPair = "ppp-disconnect-cause=Lower Layer disconnected" User-Name = "tuxper" Acct-Authentic = RADIUS Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=1000000000" Cisco-AVPair = "nas-rx-speed=1000000000" Acct-Session-Time = 57 Acct-Input-Octets = 1411 Acct-Output-Octets = 208 Acct-Input-Packets = 17 Acct-Output-Packets = 11 Acct-Terminate-Cause = User-Request Cisco-AVPair = "disc-cause-ext=TS User Exit" Acct-Status-Type = Stop Calling-Station-Id = "00-26-b6-11-7b-84" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/2/25" Cisco-AVPair = "client-mac-address=0026.b611.7b84" Service-Type = Framed-User NAS-IP-Address = xx.xx.64.94 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xx.xx.64.94,NAS-IP-Address = xx.xx.64.94,Acct-Session-Id = "000001A2",User-Name = "tuxper"' [acct_unique] Acct-Unique-Session-ID = "139952617a244d89". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "tuxper", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/xx.xx.64.94/detail-20100325 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/xx.xx.64.94/detail-20100325 [detail] expand: %t -> Thu Mar 25 10:03:51 2010 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> tuxper ++[radutmp] returns ok [sql] expand: %{User-Name} -> tuxper [sql] sql_set_user escaped user --> 'tuxper' [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> 1411 [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> 208 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2010-03-25 10:03:51', acctsessiontime = '57', acctinputoctets = '0' << 32 | '1411', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> tuxper attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated ++? if ("%{Acct-Status-Type}" != "Stop") expand: %{Acct-Status-Type} -> Stop ? Evaluating ("%{Acct-Status-Type}" != "Stop") -> FALSE ++? if ("%{Acct-Status-Type}" != "Stop") -> FALSE Sending Accounting-Response of id 102 to xx.xx.64.94 port 1646 Finished request 9. Cleaning up request 9 ID 102 with timestamp +248 Going to the next request Waking up in 2.1 seconds. Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Waking up in 4.0 seconds. rad_recv: CoA-NAK packet from host xx.xx.64.94 port 1700, id=10, length=57 No outstanding request was found for reply from host xx.xx.64.94 port 1700 - ID 10 Waking up in 4.0 seconds. Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Waking up in 8.2 seconds. rad_recv: CoA-NAK packet from host xx.xx.64.94 port 1700, id=10, length=57 No outstanding request was found for reply from host xx.xx.64.94 port 1700 - ID 10 Waking up in 8.2 seconds. Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Waking up in 15.5 seconds. rad_recv: CoA-NAK packet from host xx.xx.64.94 port 1700, id=10, length=57 No outstanding request was found for reply from host xx.xx.64.94 port 1700 - ID 10 Waking up in 15.4 seconds. No response to CoA request sent to xx.xx.64.94 Finished request 8. Cleaning up request 8 ID 98 with timestamp +248 Ready to process requests. P.S. If send Disconnect Packet to NAS, Freeradius doesn't recognize Disconnect-ACK and Disconnect-NAK from NAS too. -- С уважением, Rabidinov mailto:tuxper@mail.ru

2 3

Using Groups to Limit Authentication to Network Devices
by Doug Warner 27 Mar '10

27 Mar '10

I'm trying to setup freeradius to authenticate users via LDAP but pull group information via MySQL. I currently only need radius for authentication to network devices (switches, PDUs, etc) but want to make sure I set it up so that I don't shoot myself in the foot later. In trying to get the correct attributes assigned to a group I've noticed that I need to set Fall-Through on each group that a user belongs to in order to have later groups evaluated. Is there a better way that I can say something like, "this client should check for access from these groups" so that I only need to set Fall-Through on certain groups instead of all? -Doug

3 3

Insert Realm in mysql
by Rabidinov M.A. 27 Mar '10

27 Mar '10

Hello, Freeradius-users. I use freeradius 2.1.8 with MySQL. Freeradius doesn't insert realm into radacct table. Config: iptv:~ # grep -v '#' /etc/raddb/sql/mysql/dialup.conf ..... accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey, service_info) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}','%{Cisco-Service-Info}')" ..... iptv:~ # grep -v '#' /etc/raddb/sites-enabled/default authorize { preprocess chap mschap suffix sql expiration logintime pap } ############################################# Debug: ......... rad_recv: Accounting-Request packet from host xx.xx.64.94 port 1646, id=219, length=191 Acct-Session-Id = "0000029D" Framed-Protocol = PPP User-Name = "tuxper@un" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start Calling-Station-Id = "00-26-b6-11-7b-84" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/2/25" Cisco-AVPair = "client-mac-address=0026.b611.7b84" Service-Type = Framed-User NAS-IP-Address = xx.xx.64.94 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xx.xx.64.94,NAS-IP-Address = xx.xx.64.94,Acct-Session-Id = "0000029D",User-Name = "tuxper@un"' [acct_unique] Acct-Unique-Session-ID = "cb3670aee40aafa5". ++[acct_unique] returns ok [suffix] Looking up realm "un" for User-Name = "tuxper@un" [suffix] No such realm "un" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "tuxper@un", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/xx.xx.64.94/detail-20100327 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/xx.xx.64.94/detail-20100327 [detail] expand: %t -> Sat Mar 27 12:08:37 2010 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> tuxper@un ++[radutmp] returns ok [sql] expand: %{User-Name} -> tuxper@un [sql] sql_set_user escaped user --> 'tuxper@un' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey, service_info) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey, service_info) VALUES ('0000029D', 'cb3670aee40aafa5', 'tuxper@un', '', 'xx.xx.64.94', '0/0/2/25', 'Virtual', '2010-03-27 12:08:37', NULL, '0', 'RADIUS', '', '', '0', '0', '', '00-26-b6-11-7b-84', '', 'Framed-User', 'PPP', '', '0', '0', '','') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok .... As seen, there is no any data in %{Realm}. -- С уважением, Rabidinov mailto:tuxper@mail.ru

2 1

Howto ignore phase1 identity EAP-PEAP +mschapv2+openldap
by Fred MAISON 26 Mar '10

26 Mar '10

Hello freeradius-users, I search a way to ignore phase1 identity and avoid ldap access during phase1 for EAP-PEAP/mschapv2 I try to migrate a freeradius V1 eap + ldap instance to freeradius V2.1.8. (+1200 NAS, many kind of AP mostly Cisco, all sort of supplicants on XPSP2/SP3, MacOSX, unknown cash registers and so on all around the world ...) As I understand starting from V1 configs is always a BAD idea, I started from a default 2.1.8, with sites-enables as default and inner-tunnel, with ldap. authorize must check user has some radiusgroup-name attribute in ldap authenticate user in ldap. According to customer : For phase 1 (outter) : * no check has to be done on phase 1 (ignore outer identity, etc ...) * a huntgroup hotspot is assigned during outer preprocess For phase 2 (inner) : use inner identity to check if user has correct radiusgroup-name attribute use inner identity to validate user/password, mostly using eap-peap with mschapv2 without ntlm_auth from samba installed. I have a basic setup which seems to work (eapol-test compiled from hostapd sources), but generate a lot of logs and ldap access during phase1. It also fails if outter identity is unknown in ldap (anonymous or other fancy id encoutered in customer's freeradius v1 production auth_logs ...) I have eapol_test log and freeradius -X available. Would you have some guideline to achieve this ? Best regards Fred

2 1

EAP-PEAP - MSCHAPV2 option not working
by dev nath 26 Mar '10

26 Mar '10

Hi, I am trying to authenticate my xsupplicant with freeradius using PEAP option, but seems to fail with the below error message. Complete debug message is attached to the email. [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for peerless with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject I have tried following in my users file David User-Password=="freeradius" ---also David Auth-Type=Local, Password = "freeradius" Both does not seem to work. Please help me. Regards, Dev

4 4

freeradius 2.1.8 dies Error: ASSERT FAILED event.c[1084]: home->ev != NULL
by fab junkmail 26 Mar '10

26 Mar '10

I recently upgraded our freeradius servers to 2.1.8 and over the past month it has died on one of the servers two times (spaced about two weeks apart I think). So fairly infrequently. A bit of background, We use this server predominantly to proxy requests. Every day for about 15 minutes, the two main home servers we proxy to stop responding (they are doing backups or maintenance during this time) so for those 15 minutes our clients (LNS/NAS) would be sending a very large number of accounting interim packets and some stop packets and would be resending these while the home servers are down. Some relevant proxy home server settings we currently use for the main home servers we proxy to: response_window = 14 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 The times that freeradius has died has been near the end of the 15 minutes of the home servers downtime. The last time this happened, I noticed logs in the attached file. Ones that sound relevant as follows: Sun Mar 14 17:30:15 2010 : Proxy: Marking home server 10.0.1.48 port 1646 as zombie (it looks like it is dead). Sun Mar 14 17:30:16 2010 : Proxy: Marking home server 10.0.1.47 port 1646 as zombie (it looks like it is dead). Sun Mar 14 17:30:19 2010 : Proxy: Marking home server 10.0.1.47 port 1645 as zombie (it looks like it is dead). Sun Mar 14 17:30:19 2010 : Error: No response to status check 903535 for home server 10.0.1.48 port 1646 Sun Mar 14 17:30:20 2010 : Error: No response to status check 903536 for home server 10.0.1.47 port 1646 ... Sun Mar 14 17:30:32 2010 : Error: Internal sanity check failed for child state ... Fri Mar 19 17:30:54 2010 : Proxy: Failed to create a new socket for proxying requests. Fri Mar 19 17:30:54 2010 : Proxy: Failed to create a new socket for proxying requests. Fri Mar 19 17:30:54 2010 : Proxy: Failed to create a new socket for proxying requests. ... Fri Mar 19 17:30:56 2010 : Error: ASSERT FAILED event.c[1084]: home->ev != NULL That last one is where it dies I think. That last error seems a bit similar (but a bit different) to the following thread: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg58052.… ">Re: ASSERT FAILED event.c in 2.1.7 >Alan DeKok >Fri, 25 Sep 2009 01:19:40 -0700 > >Maja Wolniewicz wrote: >> After the upgrade from 2.1.6 to 2.1.7 my two servers died 3-4 times >> daily with the following error: >> >> Thu Sep 24 19:07:13 2009 : Error: Received conflicting packet from >> client AP-8 port 32777 - ID: 240 due to unfinished request 2396. Giving >> up on old request. >> Thu Sep 24 19:07:13 2009 : Error: ASSERT FAILED event.c[2682]: >> request->ev != NULL >> >> I have to return to 2.1.6, which works smoothly. > > The simplest thing to do in the short term is to delete the assertion. > > Alan DeKok. " That one was found to be a bug and was fixed - I don't know if my case is a bug though. Another thread that sounds useful for this is: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg59985.… "... >Until then, configuring status-checks && local detail files will >definitely help. I would recommend doing that *anyways* for network >stability. > >Alan DeKok." I don't currently use the robust proxy accounting that that thread suggests. I expect that would probably work around the issue of freeradius crashing in this case and I will give that a go. Just posting this to let you know that it _might_ be a bug and to ask for advice about whether you think this is a bug or not, and if I should follow up on that, or if you think it is just my configuration that needs some changes and what areas I should concentrate on if that is the case? Regards, Anthony

2 3

How to crypt password in database
by Paweł Pogorzelski 25 Mar '10

25 Mar '10

Hi I have problem with password encryption in mysql database: ----------------------------- *If i have in database: 1 test@realm User-Password := test I get Access Accept. ----------------------------- ----------------------------- *When i have: 2 test1@realm Crypt-Password := test123 Then i get: [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for test1@realm with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject ----------------------------- ----------------------------- in my sql.conf i have: # Read driver-specific configuration $INCLUDE sql/${database}/dialup.conf password_header = "{CRYPT}" auto_header = yes password_attribute = userPassword ----------------------------- Please help me with those crypted passwords. Best regards

3 2

Re: EAP (PEAP)+ntlm_auth doesn't send password by it self
by Cesar Ortega 25 Mar '10

25 Mar '10

Hi Alan, Thanks for your response. It didn't work either, the output is: Listening on authentication address * port 1645 Listening on accounting address * port 1646 Listening on proxy address * port 1647 Ready to process requests. rad_recv: Access-Request packet from host "AP's IP" port 1645, id=91, length=181 User-Name = "MyDOMAIN\\ortegaca" Framed-MTU = 1400 Called-Station-Id = "0015.62c8.75d0" Calling-Station-Id = "001f.3c2d.78d6" Cisco-AVPair = "ssid=radiusd" Service-Type = Login-User Message-Authenticator = 0x96ffc01213282f492a9dfebcac5f5cf0 EAP-Message = 0x02020017015044565341323030305c6f72746567616361 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "3280" NAS-Port = 3280 NAS-IP-Address = "AP's IP" NAS-Identifier = "ap" +- entering group authorize {...} [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] ... expanding second conditional [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] expand: %{User-Name:-None} -> MyDOMAIN\ortegaca [ntlm_auth] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=MyDOMAIN\ortegaca [ntlm_auth] No MS-CHAP-Challenge in the request. [ntlm_auth] expand: --challenge=%{mschap:Challenge:-00} -> --challenge= [ntlm_auth] No MS-CHAP-Response or MS-CHAP2-Response was found in the request. [ntlm_auth] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response= hex decode of failed! (only got 0 bytes) Exec-Program output: Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> MyDOMAIN\ortegaca attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 91 to "AP's IP" port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host "AP's IP" port 1645, id=92, length=181 User-Name = "MyDOMAIN\\ortegaca" Framed-MTU = 1400 Called-Station-Id = "0015.62c8.75d0" Calling-Station-Id = "001f.3c2d.78d6" Cisco-AVPair = "ssid=radiusd" Service-Type = Login-User Message-Authenticator = 0x33d0e749e1bb30e03f6bbe53e0601d27 EAP-Message = 0x02010017015044565341323030305c6f72746567616361 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "3281" NAS-Port = 3281 NAS-IP-Address = "AP's IP" NAS-Identifier = "ap" +- entering group authorize {...} [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] ... expanding second conditional [ntlm_auth] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ntlm_auth] expand: %{User-Name:-None} -> MyDOMAIN\ortegaca [ntlm_auth] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=MyDOMAIN\ortegaca [ntlm_auth] No MS-CHAP-Challenge in the request. [ntlm_auth] expand: --challenge=%{mschap:Challenge:-00} -> --challenge= [ntlm_auth] No MS-CHAP-Response or MS-CHAP2-Response was found in the request. [ntlm_auth] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response= hex decode of failed! (only got 0 bytes) Exec-Program output: Exec-Program: returned: 1 ++[ntlm_auth] returns reject Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> MyDOMAIN\ortegaca attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. As you can see above, there is something about the challenge but I really don't know what it is. So, again: What can I do for a transparent authentication against my Active Directory when a user is logged on it?. Cesar _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

2 5